From ad859352a2534a75002861adcc452d1d78ff9f8a Mon Sep 17 00:00:00 2001 From: Adsgw <97468087+Adsgw@users.noreply.github.com> Date: Mon, 24 Jan 2022 13:40:44 -0600 Subject: [PATCH] https://registry.npmjs.org steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v2 with: node-version: '14.x' registry-url: 'https://registry.npmjs.org' - run: npm install - run: npm publish env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - uses: actions/setup-node@v2 with: registry-url: 'https://npm.pkg.github.com' - run: npm publish env: NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} https://npm.pkg.github.com https://registry.npmjs.org JJ:patch-1 .gitattributes --- action.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/action.yml b/action.yml index 879ac00b5..626813018 100644 --- a/action.yml +++ b/action.yml @@ -1,4 +1,16 @@ -name: 'Setup Node.js environment' +steps: +- uses: actions/checkout@v2 +- uses: actions/setup-node@v2 + with: + node-version: '14.x' + registry-url: 'https://registry.npmjs.org' +# Skip post-install scripts here, as a malicious +# script could steal NODE_AUTH_TOKEN. +- run: npm install --ignore-scripts + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} +# `npm rebuild` will run all those post-install scripts for us. +- run: npm rebuild && npm run prepare --if-presentname: 'Setup Node.js environment' description: 'Setup a Node.js environment by adding problem matchers and optionally downloading and adding it to the PATH' author: 'GitHub' inputs: @@ -38,4 +50,4 @@ runs: using: 'node12' main: 'dist/setup/index.js' post: 'dist/cache-save/index.js' - post-if: success() \ No newline at end of file + post-if: success()